iOS VPN、配置描述文件与证书风险说明
用直白语言说明何时 VPN 应用、配置描述文件和证书是合理的，何时属于高风险安装路径。
Not every network tool is equal
A normal App Store VPN app, a custom configuration profile, and a root certificate create very different trust boundaries. Users often treat them as interchangeable privacy tools. They are not. Profiles and certificates can change how the device handles traffic or trust in ways ordinary app permissions cannot.
不是所有网络工具都一样
普通 App Store VPN、自定义配置描述文件和根证书，信任边界完全不同。用户常把它们当成可互换的隐私工具，其实不是。描述文件和证书能以普通应用权限做不到的方式改变设备处理流量或信任的方式。
When a VPN app is comparatively lower risk
A well-known App Store VPN with a clear privacy policy, no demand for unrelated permissions, and no push toward installing a profile may be acceptable for travel or public Wi‑Fi. Still review the developer, recent reviews about leaks or billing, and whether the app requires an account with weak recovery options.
何时 VPN 应用相对风险更低
知名 App Store VPN、隐私政策清楚、不索要无关权限、也不逼你安装描述文件时，用于旅行或公共 Wi‑Fi 可能可接受。仍要检查开发者、近期关于泄漏或扣费的评论，以及账号恢复是否脆弱。
Configuration profiles need a higher bar
Only install profiles from organizations you already trust for device management, such as your employer or school, and only through expected enrollment flows. Random websites that ask you to install a profile to “unlock faster streaming,” “fix battery,” or “enable free premium” are classic high-risk paths.
配置描述文件门槛应更高
只从你已信任的设备管理组织（如公司或学校）安装描述文件，且只走预期注册流程。随机网站以“解锁更快串流”“修复耗电”“开启免费高级功能”为由要求安装描述文件，是典型高风险路径。
Certificates can break the trust model
Installing an untrusted certificate can make malicious or intercepting services appear legitimate. If you do not fully understand why a certificate is required and who controls it, do not install it. Delete unknown certificates and profiles immediately from Settings if you installed one by mistake.
证书可能破坏信任模型
安装不可信证书可能让恶意或中间人服务看起来合法。若不完全理解为何需要证书以及谁控制它，就不要安装。若误装，立刻在设置中删除未知证书和描述文件。
A quick refusal checklist
Refuse if the source is unfamiliar, the benefit is vague, the install path leaves the App Store, the app demands profile installation for basic features, or support pressure you to act immediately. Slow down. Network trust changes are hard to reverse cleanly after damage is done.
快速拒绝清单
来源陌生、收益含糊、安装路径离开 App Store、基础功能却要求装描述文件，或支持方催你立刻操作时，直接拒绝。放慢节奏。网络信任变更在造成损害后很难干净回滚。
Publisher takeaway
Treat VPN apps, profiles, and certificates as separate risk classes. Prefer App Store apps with clear policies, reject surprise profile installs, and never install certificates you cannot explain. Storewise risk and knowledge pages help you frame the decision, but device Settings is where you remove dangerous trust.
发布者总结
把 VPN 应用、描述文件和证书当成不同风险等级。优先选择政策清楚的 App Store 应用，拒绝突然出现的描述文件安装，绝不安装自己解释不清的证书。Storewise 风险与知识页帮助框定决策，但危险信任要在设备设置里清除。